Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Metalytiq Research & Solutions Private Limited ("Metalytiq", the "Processor") and the Customer (the "Controller"). It applies whenever Metalytiq processes personal data on the Customer's behalf through Metalytiq Survey Cloud (the "Service"). Customers who need a signed copy can request one at [email protected].

1. Definitions

"Data Protection Law" means, as applicable, the UK GDPR and the Data Protection Act 2018, Regulation (EU) 2016/679 (the "EU GDPR"), India's Digital Personal Data Protection Act, 2023 and the rules under it, and any other law that applies to the processing. "Personal Data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in Data Protection Law. "Customer Personal Data" means Personal Data in Customer Data as defined in the Terms. "Sub-processor" means a third party Metalytiq engages to process Customer Personal Data.

2. Roles and scope

The Customer is the controller (or, where the Customer acts for its own client, a processor acting on that client's instructions) of Customer Personal Data. Metalytiq is the processor. Annex 1 describes the processing. Metalytiq is a separate controller of the account data of the Customer's users, as described in the Privacy Policy.

3. The Customer's obligations

The Customer will: have a lawful basis for the Customer Personal Data it processes and the people it contacts; give respondents the notices Data Protection Law requires, using the survey's privacy link and the AI disclosure where relevant; give Metalytiq only lawful instructions; and use the Service's controls (permissions, PII masking, deletion, data subject request tools) to meet its own obligations.

4. Metalytiq's obligations (Article 28(3))

Metalytiq will:

1. Instructions. Process Customer Personal Data only on the Customer's documented instructions, which are the Terms, this DPA, and the Customer's use of the Service's features, unless the law requires otherwise, in which case Metalytiq will tell the Customer first unless the law forbids it. Metalytiq will tell the Customer if it believes an instruction breaches Data Protection Law.
2. Confidentiality. Ensure that staff with access are bound by confidentiality and have access only when needed. Platform staff access to a workspace is recorded in that workspace's audit log.
3. Security. Apply the measures in Annex 2, and keep them under review.
4. Sub-processors. Engage only the Sub-processors in Annex 3 (the list at /legal/sub-processors); flow down equivalent obligations in writing; stay liable for their performance; and give the Customer at least 30 days' notice of a new or replaced Sub-processor by updating that page and emailing the workspace owner. The Customer may object on reasonable data-protection grounds within that period; if the objection cannot be resolved, the Customer may end the affected service and receive a refund of prepaid fees for the unused period.
5. Data subject requests. Help the Customer respond to requests from data subjects, through the Service's tools for search, export and erasure, and by forwarding any request Metalytiq receives directly within 5 business days.
6. Assistance. Help the Customer with its security, breach notification, data protection impact assessment and prior consultation obligations, taking account of the nature of the processing and the information available to Metalytiq.
7. Personal data breach. Notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data, with the information Article 33(3) requires as it becomes available, and cooperate with the Customer's own notifications.
8. Deletion and return. At the end of the Service, delete Customer Personal Data after the grace period the Customer sets (1 to 180 days, 30 by default), unless the law requires retention; the Customer may export its data at any time before then.
9. Audits. Make available the information needed to show compliance with this DPA, answer the Customer's reasonable security questionnaires once a year, and allow an audit by the Customer or an independent auditor bound by confidentiality, once in any 12-month period on 30 days' notice (or sooner after a breach), during business hours, at the Customer's cost, without disrupting other customers.

5. International transfers

Metalytiq is established in India. Where Customer Personal Data subject to the UK GDPR or the EU GDPR is transferred to Metalytiq or to a Sub-processor outside the UK or the EEA, the parties rely on:

• for the EU GDPR, the Standard Contractual Clauses adopted by Commission Decision (EU) 2021/914, Module Two (controller to processor), or Module Three where the Customer is a processor, which are incorporated by reference with the options and annexes completed by this DPA;
• for the UK GDPR, the International Data Transfer Addendum to the EU SCCs issued by the Information Commissioner, incorporated by reference;
• for other jurisdictions, the mechanism Data Protection Law allows.

Under India's DPDP Act, the Customer, as the data fiduciary where it is one, and Metalytiq, as data processor, will observe any restriction the Central Government notifies on transfers to particular countries.

6. Liability

The liability of each party under this DPA is subject to the limits in the Terms, except as Data Protection Law does not allow.

7. Term and precedence

This DPA applies for as long as Metalytiq processes Customer Personal Data. If it conflicts with the Terms, this DPA prevails; if it conflicts with the SCCs or the UK Addendum, those prevail.

---

Annex 1: Description of the processing

Annex 2: Technical and organisational measures

These are the measures in place at the effective date. They describe the Service as built; the Privacy Policy section 7 summarises them for users.

Access control. Each workspace has its own database; the application resolves the workspace from the request's host name and no code path can address another workspace's data. Role-based permissions (62 permissions, 11 built-in roles, custom roles). Personal data columns are masked in data views and exports unless the user holds the permission to see them; contact details need a separate permission. Platform staff access to workspace data is logged in the workspace's audit log.

Authentication. Argon2id password hashing; passwords of at least 12 characters with mixed case and a digit; 15-minute lockout after 8 failed attempts; 15-minute access tokens and 30-day rotating refresh tokens with reuse detection; OpenID Connect single sign-on on request; API keys stored as hashes with scopes, IP allow-lists and rate limits. Multi-factor authentication is not yet available.

Encryption. TLS for all traffic between users, respondents and the Service. Contact details in sample lists, panel member identities, campaign recipients and interviewer phone numbers are encrypted in the database (AES-256-GCM). Uploaded files are stored on the application server's disk; the database and disk are not separately encrypted at rest.

Logging and integrity. An append-only, hash-chained audit log of every change in a workspace (actor, action, before and after, IP address, time). Request logs for API keys. Media files served only to surveys that use them; respondents can fetch only their own uploads.

Pseudonymisation. Respondent IP addresses are stored as keyed hashes unless the Customer switches on raw IP recording; duplicate detection works on hashes; small groups are suppressed in shared dashboards; exports can mask personal data.

Availability. Rate limiting on sign-up, password reset, interview start, uploads and AI calls; graceful handling of interrupted interviews with resume for 7 days. Automated backups are not yet in place.

Data subject requests. A Privacy screen for admins to search a workspace by identifier, export a subject's data and erase it with a certificate, plus a request register.

Deletion. Soft deletion of responses with exclusion from analysis; hard deletion of responses and workspaces; AI voice recordings deleted after the retention period the Customer sets.

Organisational. Confidentiality obligations for staff; an information security policy and an incident response plan (internal); least-privilege access to production; secrets kept outside the code; sub-processor due diligence.

Annex 3: Sub-processors

The current list, with role and location, is at /legal/sub-processors and forms part of this DPA.